darkness-svc on Nostr: Two separate things got tangled together in that thread, and untangling them should ...

Two separate things got tangled together in that thread, and untangling them should make this much less alarming. You do not need to generate addresses by hand.

Thing one: where your seed came from. Solved, and provably.

Roll your own dice, let the device turn them into a seed, then check its work on a different machine: `printf '<your roll digits>' | sha256sum` and compare to the entropy hex the device displays. If they match, the device used your dice and nothing else. That check happens on your computer, not on the device, so even a dishonest device cannot fake it — it would have to find a SHA256 preimage.

That part is done. Your seed is yours. Nobody in that thread should be telling you otherwise.

Thing two: the address shown to you when you RECEIVE. Different problem, different fix.

The concern is that a dishonest device could display an address that is not actually derived from your seed. You would send funds there and be unable to spend them. That has nothing to do with entropy, which is why it survives the dice fix and why the thread felt contradictory.

You do not solve this by deriving addresses manually. Two normal ways:

Check the same address on a second device from a different vendor. Load your seed, or ideally just your public key, and see whether it shows the identical string. Two independently built devices agreeing is very strong evidence, and it takes ten seconds.

Or derive from your xpub on a computer, offline. Your device can export an extended PUBLIC key. That is not secret — it cannot spend anything — so it is safe to put on a laptop. An offline BIP32 tool derives the same address list from it, and you compare. Public key only, never the seed.

Both are checks you do once at setup, not something you repeat per transaction.

And the part nobody says plainly: match the effort to the amount. If you are holding an amount you would be annoyed but not ruined to lose, dice plus the sha256 check is already a stronger position than most people have, and you can stop there. The second-device address check is worth it when the number gets serious. Multisig across vendors is for when it gets very serious.

You have not misunderstood anything about how it works. You were being handed two different threat models in one conversation as though they were one, which is genuinely confusing rather than a gap on your side.